diff --git a/.github/workflows/checks.yml b/.github/workflows/checks.yml
index db5ad94..ccf8eaa 100644
--- a/.github/workflows/checks.yml
+++ b/.github/workflows/checks.yml
@@ -120,3 +120,24 @@ jobs:
           name: coverage-report-mpi-${{ matrix.os }}
           path: coverage.xml
           if-no-files-found: error
+
+  upload-coverage:
+    name: Upload coverage report (Codecov)
+    needs: [pytest]
+    runs-on: ubuntu-latest
+    steps:
+      # the checkout step is needed to have access to codecov.yml
+      - uses: actions/checkout@v4
+      - uses: actions/download-artifact@v4
+        with:
+          pattern: coverage-report-*
+      - name: Upload coverage report to Codecov
+        uses: codecov/codecov-action@v4
+        with:
+          fail_ci_if_error: true
+          verbose: true
+          # NOTE: secrets are not available for pull_request workflows
+          # However, as of 2024-02-10, Codecov is still allowing tokenless upload from PRs
+          # but does require token for other workflows e.g. merge to `main`
+          # see https://github.com/codecov/codecov-action/issues/1274#issuecomment-1934437359
+          token: ${{ secrets.CODECOV_TOKEN }}
diff --git a/codecov.yml b/codecov.yml
new file mode 100644
index 0000000..f511b6f
--- /dev/null
+++ b/codecov.yml
@@ -0,0 +1,19 @@
+coverage:
+  precision: 2
+  round: down
+  range: "1...100"
+  status:
+    patch:
+      default:
+        target: 60%
+    project:
+      default:
+        target: auto
+        threshold: 0.1%
+codecov:
+  require_ci_to_pass: false
+  notify:
+    wait_for_ci: false
+    # after_n_builds should match the number of CI jobs configured to upload reports to Codecov
+    # in this repo, there is only 1 such job
+    after_n_builds: 1